394a016e6b1b3b0b2d743ed2e003ea185921186517047dcdd3c296193e4671c4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

394a016e6b1b3b0b2d743ed2e003ea185921186517047dcdd3c296193e4671c4
Size

61KB
MD5

8329821604b768ffe4a9f4cab652346d
SHA1

6dffc2623cac5acac598525ea50926b0c61382cb
SHA256

394a016e6b1b3b0b2d743ed2e003ea185921186517047dcdd3c296193e4671c4
SHA512

3d63deab003bc2042e18e8a22d51e064d3d795b9bd07a6bc154da6c329214dab2d62bf94399501bb528092f17c2ce64dd8a93fe870105a269100983aeab76987
SSDEEP

1536:u+kOKnQlDjjkL4EyLcAwbIj7KR9ffGTg+b:qN0jjkL4EyIAwbIjq9X6

Score

N/A

Malware Config

Signatures

Files

394a016e6b1b3b0b2d743ed2e003ea185921186517047dcdd3c296193e4671c4
.exe windows x86

7cd129c8e2e39c6fbcc370fe42a1dd83

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlCopyRangeList
IoFreeIrp
InterlockedExchangeAdd
PsReturnPoolQuota
ExAllocatePoolWithTagPriority
PsChargeProcessPoolQuota
RtlCopyUnicodeString
RtlCompareUnicodeString
MmResetDriverPaging

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ